The Codepeople Contact Form Email plugin allows untrusted input to be stored and displayed without proper neutralization, creating a stored cross‑site scripting weakness. This flaw can enable an attacker to inject malicious scripts that execute in the browsers of any user who views the affected page, potentially exposing authentication cookies, tampering with data, or redirecting users to harmful sites.

WordPress sites that use the Codepeople Contact Form Email plugin, versions ranging from the earliest releases through 1.3.68, are affected.

The CVSS score of 7.1 indicates a medium‑to‑high severity, while the EPSS score is not provided and the vulnerability is not in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires users to submit payloads through the form which are then stored and served to visitors; thus, any user interaction with the affected form offers an opportunity to trigger the XSS payload. Exploitation is relatively straightforward for an attacker with access to the form or ability to control its input fields, and the impact may include theft of session data or defacement of the site.